The joiner-mover-leaver process, step by step

The HR system of record (Workday, SuccessFactors, BambooHR, Oracle HCM or similar) is the trigger for all three events. Governance platforms read it directly: Okta Lifecycle Management provisions from HR systems such as Workday and SuccessFactors, Lumos monitors the HRIS for role, department, manager and status changes, and C1 connects HR systems so a join, role change, leave or departure triggers a workflow.

1. HR record created with start date, role, department and manager.
2. Birthright access assigned by policy (email, HR self-service, collaboration tools).
3. Role-based access requested or assigned for the specific job.
4. Disconnected apps: ticket to each app owner with the required role and a due date before start.
5. Record who created each account and when.

Movers are where access accumulates. The rule is add and remove in the same change: grant the new role's access and remove the old role's access, with a short overlap only where handover requires it and an end date on that overlap. Veza, SailPoint and Lumos all describe removing no-longer-needed access on role change for connected systems. For disconnected apps, a mover ticket must list the access to remove, not only the access to add.

1. HR termination date set; leaver workflow starts on that date (or immediately for involuntary exits).
2. IdP account disabled, which blocks federated sign-on.
3. Connected app accounts disabled or removed by the IGA.
4. Disconnected and local accounts removed by ticket to each app owner, with a deadline.
5. Shared, service and break-glass credentials the person knew are rotated.
6. Evidence recorded: which accounts, removed by whom, when.

Set them in policy and measure against them. NIST SP 800-53 Rev. 5 AC-2 leaves the time periods to the organization: it asks that account managers be notified within an organization-defined time period when users are terminated or transferred, and AC-2(3) asks that accounts be disabled within a defined period when they are no longer associated with a user or have been inactive. DORA's technical standard (EU 2024/1774, Article 21) requires withdrawal of access rights upon termination of employment. Whatever deadline you set, apply it to disconnected apps as well.

Four options, often combined: build a connector (in-house or by a systems integrator), use the IGA's file or ticket-based fulfilment (Microsoft documents ServiceNow tickets from Entra entitlement management), use RPA to drive the app's admin screens (Palo Alto Networks' Idira describes this), or use a discovery tool that maps accounts inside the app and feeds the IGA (Orchid Security's approach). See the disconnected applications guide.